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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

The attached report presents the results of U.S Customs and Border Protection's consolidated 
financial statement audits for fiscal years (FY) 2008 and 2007. We contracted with the independent 
public accounting firm KPMG LLP (KPMG) to perform the audits. The contract required that 
KPMG perform its audits according to generally accepted government auditing standards and 
guidance from the Office of Management and Budget and the Government Accountability Office. 
KPMG concluded that CBP's consolidated financial statements as of and for the years ended 
September 30, 2008 and 2007, are presented fairly, in all material respects, in conformity with U.S. 
generally accepted accounting principles. The FY 2008 auditors' report discusses one material 
weakness, three significant deficiencies in internal controls, and two instances of noncompliance 
with laws and regulations. KPMG is responsible for the attached draft auditor's report and the 
conclusions expressed in the report. We do not express opinions on CBP's financial statements or 
provide conclusions on compliance with laws and regulations. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. It is our hope that this report will result in more effective, efficient, and economical 
operations. We express our appreciation to all of those who contributed to the preparation of this 
report. 




Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Independent Auditors' Report 

Inspector General 

U.S. Department of Homeland Security: 
Commissioner 

U.S. Customs and Border Protection: 

We have audited the accompanying consolidated balance sheets of the U.S. Department of Homeland 
Security's (DHS) Customs and Border Protection (CBP) as of September 30, 2008 and 2007, and the 
related consolidated statements of net cost, changes in net position, and custodial activity, and combined 
statements of budgetary resources (hereinafter referred to as "consolidated financial statements") for the 
years then ended. The objective of our audits was to express an opinion on the fair presentation of these 
consolidated financial statements. In connection with our fiscal year 2008 audit, we also considered 
CBP's internal controls over financial reporting and tested CBP's compliance with certain provisions of 
applicable laws, regulations, and contracts that could have a direct and material effect on these 
consolidated financial statements. 

Summary 

As stated in our opinion on the consolidated financial statements, we concluded that CBP's consolidated 
financial statements as of and for the years ended September 30, 2008 and 2007, are presented fairly, in 
all material respects, in conformity with U.S. generally accepted accounting principles. 

Our consideration of internal control over financial reporting resulted in the following conditions being 
identified as significant deficiencies: 

1. Drawback of Duties, Taxes, and Fees 

2. Financial Reporting 

a. Property, plant, and equipment 

b. Inactive obligations 

3. Entry Process 

a. In-Bond Program 

b. Compliance Measurement 

c. Bonded Warehouse and Foreign Trade Zones 

4. Information Technology 

We consider the first significant deficiency, above, to be a material weakness. 

The results of our tests of compliance with certain provisions of laws, regulations, and contracts disclosed 
the following instances of noncompliance or other matters that are required to be reported under 
Government Auditing Standards, issued by the Comptroller General of the United States, and Office of 
Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements for Federal Financial 
Statements: 

1 . Federal Information Security Management Act (FISMA) - Electronic Government Act of 
2002 

2. Federal Financial Management Improvement Act of 1996 (FFMIA) 




KPMG LLP. a U.S. limited liability partnership, is the U.S. 
member firm of KPMG International, a Swiss cooperative. 



The following sections discuss our opinion on CBP's consolidated financial statements; our consideration 
of CBP's internal controls over financial reporting; our tests of CBP's compliance with certain provisions 
of applicable laws, regulations, and contracts; and management's and our responsibilities. 

Opinion on the Financial Statements 

We have audited the accompanying consolidated balance sheets of the U.S. Department of Homeland 
Security's (DHS) Customs and Border Protection (CBP) as of September 30, 2008 and 2007, and the 
related consolidated statements of net cost, changes in net position, and custodial activity, and the 
combined statements of budgetary resources for the years then ended. 

In our opinion, the consolidated financial statements referred to above present fairly, in all material 
respects, the financial position of CBP as of September 30, 2008 and 2007, and its net costs, changes in 
net position, budgetary resources, and custodial activity for the years then ended, in conformity with U.S. 
generally accepted accounting principles. 

The information in the Management's Discussion and Analysis and Required Supplementary Information 
is not a required part of the consolidated financial statements, but is supplementary information required 
by U.S. generally accepted accounting principles. We have applied certain limited procedures, which 
consisted principally of inquiries of management regarding the methods of measurement and presentation 
of this information. However, we did not audit this information and, accordingly, we express no opinion 
on it. 

Our audits were conducted for the purpose of forming an opinion on the consolidated financial statements 
taken as a whole. The information in the Performance Results Section and Other Accompanying 
Information section are presented for purposes of additional analysis and are not required as part of the 
consolidated financial statements. This information has not been subjected to auditing procedures and, 
accordingly, we express no opinion on it. 

Internal Control Over Financial Reporting 

Our consideration of the internal control over financial reporting was for the limited purpose described in 
the Responsibilities section of this report and would not necessarily identify all deficiencies in the internal 
control over financial reporting that might be significant deficiencies or material weaknesses. 

A control deficiency exists when the design or operation of a control does not allow management or 
employees, in the normal course of performing their assigned functions, to prevent or detect 
misstatements on a timely basis. A significant deficiency is a control deficiency, or combination of 
control deficiencies, that adversely affects CBP's ability to initiate, authorize, record, process, or report 
financial data reliably in accordance with U.S. generally accepted accounting principles such that there is 
more than a remote likelihood that a misstatement of CBP's consolidated financial statements that is more 
than inconsequential will not be prevented or detected by CBP's internal control. A material weakness is 
a significant deficiency, or combination of significant deficiencies, that results in more than a remote 
likelihood that a material misstatement of the financial statements will not be prevented or detected by 
CBP's internal control. 

In our fiscal year 2008 audit, we consider the deficiencies, described in Exhibits I and II, to be significant 
deficiencies in internal control over financial reporting. However, of the significant deficiencies described 
in Exhibits I and II, we believe that the significant deficiency presented in Exhibit I is a material 
weakness. Exhibit IV presents the status of prior year significant deficiencies. 



Compliance and Other Matters 

The results of certain of our tests of compliance as described in the Responsibilities section of this report, 
exclusive of those referred to in the Federal Financial Management Improvement Act of 1996 (FFMIA), 
disclosed one instance of noncompliance or other matters that are required to be reported herein under 
Government Auditing Standards or OMB Bulletin No. 07-04, and is described in Exhibit III. 

The results of our other tests of compliance as described in the Responsibilities section of this report, 
exclusive of those referred to in FFMIA, disclosed no instances of noncompliance or other matters that are 
required to be reported herein under Government Auditing Standards or OMB Bulletin No. 07-04. 

The results of our tests of FFMIA disclosed instances, described in Exhibit III, in which CBP's financial 
systems did not substantially comply with Federal financial management systems requirements and were 
not compliant with the United States Government Standard General Ledger at the transaction level. 

The results of our tests of FFMIA disclosed no instances in which CBP's financial management systems 
did not substantially comply with Federal accounting standards. 

Responsibilities 

Management's Responsibilities. Management is responsible for the consolidated financial statements; 
establishing and maintaining effective internal control; and complying with laws, regulations, and 
contracts applicable to CBP. 

Auditors' Responsibilities. Our responsibility is to express an opinion on the fiscal year 2008 and 2007 
consolidated financial statements of CBP based on our audits. We conducted our audits in accordance 
with auditing standards generally accepted in the United States of America; the standards applicable to 
financial audits contained in Government Auditing Standards, issued by the Comptroller General of the 
United States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 require that 
we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial 
statements are free of material misstatement. An audit includes consideration of internal control over 
financial reporting as a basis for designing audit procedures that are appropriate in the circumstances, but 
not for the purpose of expressing an opinion on the effectiveness of CBP's internal control over financial 
reporting. Accordingly, we express no such opinion. 

An audit also includes: 

• Examining, on a test basis, evidence supporting the amounts and disclosures in the consolidated 
financial statements; 

• Assessing the accounting principles used and significant estimates made by management; and 

• Evaluating the overall consolidated financial statement presentation. 
We believe that our audits provide a reasonable basis for our opinion. 

In planning and performing our fiscal year 2008 audit, we considered CBP's internal control over 
financial reporting by obtaining an understanding of CBP's internal control, determining whether internal 
controls had been placed in operation, assessing control risk, and performing tests of controls as a basis 
for designing our auditing procedures for the purpose of expressing our opinion on the consolidated 
financial statements. We did not test all internal controls relevant to operating objectives as broadly 
defined by the Federal Managers' Financial Integrity Act of 1982. The objective of our audit was not to 



express an opinion on the effectiveness of CBP's internal control over financial reporting. Accordingly, 
we do not express an opinion on the effectiveness of CBP's internal control over financial reporting. 

As part of obtaining reasonable assurance about whether CBP's fiscal year 2008 consolidated financial 
statements are free of material misstatement, we performed tests of CBP's compliance with certain 
provisions of laws, regulations, and contracts, noncompliance with which could have a direct and material 
effect on the determination of the consolidated financial statement amounts, and certain provisions of 
other laws and regulations specified in OMB Bulletin No. 07-04, including the provisions referred to in 
Section 803(a) of FFMIA. We limited our tests of compliance to the provisions described in the 
preceding sentence, and we did not test compliance with all laws, regulations, and contract agreements 
applicable to CBP. However, providing an opinion on compliance with laws, regulations, and contract 
agreements was not an objective of our audit and, accordingly, we do not express such an opinion. 



CBP's response to the findings identified in our audit are presented in Exhibits I, II, and III. We did not 
audit CBP's response and, accordingly, we express no opinion on it. 

This report is intended solely for the information and use of CBP's management, DHS management, the 
DHS Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. 
Congress and is not intended to be and should not be used by anyone other than these specified parties. 



December 4, 2008 
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Material Weaknesses 

A. Drawback of Duties, Taxes and Fees 

Background: 

CBP, as a component of DHS, continued to perform an important revenue collection function for the U.S. 
Treasury. CBP collects approximately $31.4 billion in import duties, taxes and fees annually on 
merchandise arriving in the United States from foreign countries. 

Drawback is a remittance in whole or in part, of duties, taxes, or fees previously paid by an importer. 
Drawback typically occurs when the imported goods on which duties, taxes, or fees have been previously 
paid are subsequently exported from the United States or destroyed prior to entering the commerce of the 
United States. Depending on the type of drawback claim, the claimant has up to eight years from the date 
of importation to file for drawback. During fiscal year 2005, the U.S. Congress enacted the 
Miscellaneous Trade and Technical Corrections Act of 2004 (Public Law 108-429) that created a limited 
timeframe for liquidating claims; the new process is known as deemed-liquidation by CBP. As a result of 
the new timeframe for liquidation of drawback claims, CBP implemented policies and procedures during 
fiscal year 2006 that require the payment of claims in an accelerated timeframe. 

Condition: 

We noted the following weaknesses related to internal controls over drawback of duties, taxes, and fees 
paid by the importer: 

• The Automated Commercial System (ACS) lacked automated controls to detect and prevent 
excessive drawback claims and payments, necessitating inefficient manual processes that do 
not effectively compensate for the lack of automated controls. ACS did not have the 
capability to compare, verify, and track essential information on drawback claims to the 
related underlying consumption entries or export documentation upon which the drawback 
claim was based. For example, ACS did not contain electronic edit checks that would identify 
duplicate claims for export of the same merchandise; 

• ACS lacked controls to prevent the overpayment of drawback claims at the summary line 
level. Specifically, we noted approximately $3 thousand of overpayments; 

• Drawback review policies did not require drawback specialists to review all or a statistically 
valid sample of prior drawback claims against the underlying consumption entries (UCE) to 
determine whether, in the aggregate, an excessive amount was claimed. CBP does not have 
absolute assurance that a selected import entry is not being over claimed by different 
drawback claims; 

• Drawback review policy and procedures allow drawback specialists, with supervisory 
approval, to judgmentally decrease the number of ACS selected UCEs randomly selected for 
review, thus decreasing the review's effectiveness. Further, CBP's sampling methodology for 
selecting UCEs is not considered to be statistically valid; and 
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• Per CBP's "Drawback Handbook," the initial period for document retention related to a 
drawback claim is only 3 years from the date of payment. However, there are several 
situations that could extend the life of the drawback claim well beyond 3 years. 

Cause/Effect: 

Much of the drawback process is manual, placing an added burden on limited resources. CBP uses a 
sampling approach to compare, verify, and match consumption entry and export documentation to 
drawback claims submitted by importers. However, system and procedural limitations decrease the 
effectiveness of this approach. The inherent risk of fraudulent claims or claims made in error is high, 
which increase the risk of erroneous payments. 

Criteria: 

Under the Federal Managers Financial Integrity Act (FMFIA), management must implement cost- 
effective controls to safeguard assets and ensure reliable financial reporting. Office of Management and 
Budget (OMB) 's Revised Implementation Guidance for the Federal Financial Management Improvement 
Act states that financial systems should "routinely provide reliable financial information consistently, 
accurately, and reported uniformly" to support management of current operations. The Federal Systems 
Integration Office (FISO) publications and OMB Circular A- 127, Financial Management Systems, outline 
the requirements for Federal systems. FISO's Core Financial System Requirements states that the core 
financial system must maintain detailed information by account sufficient to provide audit trails and to 
support billing and research activities. OMB Circular A- 127 requires that the design of financial systems 
should eliminate unnecessary duplication of a transaction entry. Whenever appropriate, data needed by 
the systems to support financial functions should be entered only once and other parts of the system 
should be updated through electronic means consistent with the timing requirements of normal 
business/transaction cycles. 

The Improper Payments Information Act of 2002 requires agencies to annually review programs and 
activities and identify any that may be susceptible to significant improper payment. Whenever an agency 
estimates that improper payments may exceed $ 1 million, it must also provide a report on what actions 
are being taken to reduce such payments. In addition to the regulatory requirements stated above, CBP's 
Drawback Handbook, dated March 2007, states that management reviews are necessary to maintain a 
uniform national policy of supervisory review. 

Recommendations: 

We recommend that CBP: 

1. Implement effective internal controls over drawback claims as part of any new system 
initiatives, including the ability to compare, verify, and track essential information on drawback 
claims to the related underlying consumption entries and export documentation for which the 
drawback claim is based, and identify duplicate or excessive drawback claims; 

2. Implement automated controls within ACS and ACE to prevent overpayment of a drawback 
claim; 

3. While the Automated Commercial Environment (ACE) is in development, we recommend that 
CBP collaborate with ACE developers/engineers to ensure that the new system eliminates the 
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need for statistically sampling of UCE and prior related drawback claims as drawback claims. 
In addition, until ACE is implemented, we recommend that CBP explore other statistical 
approaches for selecting UCEs and prior related drawback claims under the current ACS 
environment; 

4. Continue to work with the U.S. Congress to lengthen the required document retention period 
for all supporting documentation so that it corresponds with the drawback claim life cycle. 

CBP Response: 

See managements' response included in the attached letter. 
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Other Significant Deficiencies 

B. Financial Reporting 

1. Property, Plant, and Equipment 

a. Secure Border Initiative - Tactical Infrastructure 
Background: 

The Secure Border Initiative - Tactical Infrastructure (SBI-TI) is a comprehensive multi-year 
plan to secure America's borders and reduce illegal immigration. The primary step in 
fulfilling this plan is the construction of a border fence between the U.S. and Mexico. The 
border fence will take many forms (fence, vehicle barriers, etc.) depending on the terrain of 
the land. Much of the physical fence construction includes large quantities of steel. As a 
result, CBP purchased steel in bulk during fiscal year 2008 to be used in the construction of 
the border fence. 

Condition: 

During fiscal year 2008, CBP purchased a total of $276 million in steel. We noted that these 
purchases were initiated during the second and third quarter of the fiscal year, with the 
majority purchased and received during August and September. Through August 2008, $224 
million of bulk steel was purchased and received; however, CBP did not have procedures in 
place to capitalize the costs into the financial accounting system (SAP) until September 2008. 
We noted that all bulk steel purchases received as of September 30, 2008 were properly 
capitalized by year-end. 

We also performed testwork over CBP's percentage of completion accrual related to SBI-TI 
fence and vehicle barriers and noted that CBP did not have sufficient support for the 
percentage of completion for these projects. As a result, we noted a potential overstatement 
of approximately $41.3 million in construction in progress (CIP) as of September 30, 2008. 

Criteria: 

Statement of Federal Financial Accounting Standards (SFFAS) No. 6, Accounting for 
Property, Plant, and Equipment, requires that: 

PP&E shall be recorded at cost, which shall include all costs incurred to bring the asset 
to a form and location suitable for its intended use; 

- Costs of acquiring property, plant, and equipment may include: labor and other direct 
or indirect production costs (for assets produced or constructed), an appropriate share 
of the cost of the equipment and facilities used in construction work (CIP assets), and 
direct costs of inspection, supervision, and administration of construction work; and 

- PP&E shall be recorded as construction work in process until it is placed in service, at 
which time the balance shall be transferred to general PP&E. 
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Office of Management and Budget (OMB) Circular No. A-123, Management's 
Responsibility for Internal Control, defines management's responsibility for internal 
control and provides guidance to Federal managers on improving the accountability and 
effectiveness of Federal programs and operations by establishing, assessing, correcting, and 
reporting on internal control. 

Cause/Effect: 

The construction of the SBI-TI border fence was a new process for CBP during fiscal year 
2008 and as a result processes and procedures did not exist to properly account for all 
related transactions in a timely manner. The untimely capitalization of assets (steel) 
purchased and received for the SBI-TI fence construction could result in misstatements of 
CBP's financial statements. For example, we noted a potential overstatement of 
approximately $41.3 million in CIP as of September 30, 2008. 

Recommendations: 

We recommend that CBP: 

1 . Establish a process for properly and accurately accounting for all assets purchased in a 
timely manner for the purposes of SBI-TI fence construction projects; and 

2. Ensure the records in SAP are accurate and complete with documentation available 
supporting the transactions that are readily available for examination. 

b. Untimely Transfers of Construction in Progress to Fixed Assets 

Background: 

During the fiscal years 2006 and 2007 financial statement audits, we noted untimely transfers 
of construction in progress (CIP) assets to fixed assets, in which a majority related to 
software in development. In fiscal year 2008, we continued to identify assets included in the 
CIP listing that were completed, but not transferred to fixed assets in a timely manner. As a 
result, CIP assets were overstated and fixed assets as well as the related accumulated 
depreciation and depreciation expense were understated. 

Condition: 

During fiscal year 2008, we continued to note weaknesses related to the untimely transfers of 
completed CIP assets to fixed assets. Specifically, we noted 28 instances in which assets 
were transferred untimely from CIP to fixed assets. These 28 errors resulted in $10.8 million 
of unrecognized accumulated depreciation and related depreciation expense. As a result, 
CBP performed an analysis of additions to fixed assets to identify the overall impact of 
untimely transfers from CIP to fixed assets as of September 30, 2008. Based on this analysis, 
CBP identified and corrected a total of $49 million of unrecorded accumulated depreciation 
and related depreciation expense as of September 30, 2008. Furthermore, $42 million of the 
$49 million, related to prior year depreciation thereby causing current year depreciation 
expense to be overstated by $42 million. 
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Criteria: 

Statement of Federal Financial Accounting Standards (SFFAS) No. 6, Accounting for 
Property, Plant, and Equipment, requires that: 

- PP&E shall be recorded at cost, which shall include all costs incurred to bring the 
asset to a form and location suitable for its intended use; 

Costs of acquiring property, plant, and equipment may include: labor and other 
direct or indirect production costs (for assets produced or constructed), an appropriate 
share of the cost of the equipment and facilities used in construction work (CIP 
assets), and direct costs of inspection, supervision, and administration of construction 
work; and 

- PP&E shall be recorded as construction work in process until it is placed in service, 
at which time the balance shall be transferred to general PP&E. 

Office of Management and Budget (OMB) Circular No. A-123, Management's 
Responsibility for Internal Control, defines management's responsibility for internal 
control and provides guidance to Federal managers on improving the accountability and 
effectiveness of Federal programs and operations by establishing, assessing, correcting, and 
reporting on internal control. 

Cause/Effect: 

Completed CIP assets are not transferred from CIP to fixed assets in a timely manner. As a 
result, CIP, PP&E, and the related financial statement balances may be misstated at any point 
during the fiscal year. For example, we noted an overstatement of approximately $42 million 
in depreciation expense as of September 30, 2008. 

Recommendation: 

We recommend that CBP: 

1 . Implement policies and procedures to ensure proper coordination between the Field 
Project Managers and the National Finance Center related to CIP project monitoring; 

2. Establish periodic communication between the CIP Project Managers and the 
National Finance Center to ensure that when projects are complete, the assets are 
appropriately transferred from CIP to fixed assets in SAP; and 

3. Implement policies and procedures that require the National Finance Center to 
perform periodic reviews over CIP assets to ensure that all CIP assets are regularly 
monitored and properly classified. 

CBP Response: 

See managements' response included in the attached letter. 
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2. Inactive Obligations 
Background: 

CBP issued Directive 1220-01 IB during fiscal year 2006, which requires each Office under CBP to 
review their obligations quarterly in order to properly identify those amounts that require deobligation. 
The review must be reported to CBP's National Finance Center (NFC) each quarter. 

Condition: 

We noted weaknesses in CBP's policies and procedures related to timely deobligation of inactive 
obligations. During fiscal year 2008, we obtained the population of inactive obligations that CBP 
prepared and submitted to the Department. We noted that CBP's quarterly analysis of inactive 
obligations reported the amount of "old" inactive obligations to the Department, but did not include 
evidence of further review and deobligation. We noted at March 31, 2008, $449 million of inactive 
obligations and conducted a review to determine if the obligations were valid. We identified $275 million 
of inactive obligations potentially requiring deobligation. CBP performed an in-depth review of 
obligations during fiscal year 2008 from which invalid obligations were identified for deobligation. CBP 
was unable to process all deobligations at the detail level prior to September 30, 2008 and therefore, 
recorded an on-top adjustment for inactive obligations in the amount of $84.8 million. 

Through additional testing of undelivered orders (UDOs) as of September 30, 2008, we noted 9 
exceptions whereby the UDO balance was determined invalid. As a result of these exceptions, CBP 
analyzed and adjusted the September 30, 2008 UDO balance by approximately $76.5 million. 

Criteria: 

US Code Title 31 Section 1501 states that "an amount shall be recorded as an obligation of the United 
States Government only when supported by documentary evidence of (1) a binding agreement between an 
agency and another person (including an agency) that is (a) in writing, in a way and form and for a 
purpose authorized by law; and (b) executed before the end of the period of availability." Section 1554, 
Audit, control and reporting states, "The head of each agency shall establish internal controls to assure 
that an adequate review of obligated balances is performed to support the certification required by section 
1108(c) of this title." 

CBP Directive 1220-01 IB, Quarterly Review of Unliquidated Obligations, states that "Financial Plan 
Holder will review the following Systems, Applications, and Products (SAP) reports each fiscal quarter to 
reconcile their obligations to supporting records." This directive also requires that "Each Assistant 
Commissioner will prepare a certification letter to the Director, National Finance Center, stating that 
he/she has reviewed all open obligations. The certification letter will be prepared at the end of each fiscal 
year quarterly review, and is due no later than 30 days after the end of the quarter. For the fourth quarter, 
year-end deadlines are to be followed." 

Cause/Effect: 

CBP is not properly monitoring all open obligations on a periodic basis to determine if amounts require 
deobligation. As a result, undelivered orders and related account balances may be overstated at any point 
during the fiscal year. For example, we noted a potential overstatement of approximately $76.5 million in 
the UDO balance as of September 30, 2008. 
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Recommendations : 

We recommend that CBP: 

1. Develop and implement policies and procedures to ensure compliance with Directive No. 1220- 
01 IB to ensure that obligations are being reviewed (and deobligated, if necessary) on a quarterly 
basis; 

2. Develop and implement policies and procedures to ensure compliance with 31 USC 1501 and 31 
USC 1554 and all other applicable laws and regulations; and 

3. Develop and implement procedures in order to deobligate invalid obligations in a timely manner, 
which may include periodic validation of inactive obligations. 

CBP Response: 

See managements' response included in the attached letter. 

C. Entry Process 
1. In-Bond Program 
Background: 

In-bond entries occur when merchandise is transported through one port; however, the merchandise does 
not officially enter U.S. commerce until it reaches the intended port of destination. An in-bond also 
allows foreign merchandise arriving at one U.S. port to be transported through the U.S. and be exported 
from another U.S. port without appraisement or the payment of duty. In 1998, CBP implemented a 
tracking and audit system within the Automated Commercial System (ACS). It was designed to provide "real 
time" tracking of in-bond shipments from origin to destination, including entry and exportation. This 
tracking and audit system also serves as a compliance measurement system through random examinations 
and port audit reviews to ensure compliance. The tracking and audit system was designed to prevent 
diversion of In-bond shipments being imported and exported. The tracking and audit system calls for 
randomly selected ports to perform physical examinations at the time of arrival and departure as well as 
for post audit reviews of carrier activity. The In-Bond Shipments Overdue for Export (M02) Report is a 
monthly list of in-bond shipments overdue for export. Items on this report are in-bond movements 
transmitted by importers or brokers via Air Manifest System (AMS), Automated Broker Interface (ABI), 
or paper not yet exported in the required time limit. Review of the M02 report is designed to identify 
cargo that has not been exported and therefore may have physically, but not formally, entered into U.S. 
commerce thus circumventing the assessment and payment of duties and fees. 

Condition: 

We noted the following internal control weaknesses related to the in-bond process: 

• Inconsistent procedures followed by the ports for completing compliance reviews/audits of 
in-bond entries and no formal requirement for ports to maintain documentation evidencing 
reviews/audits or the overall lack of the completion of such reviews/audits; 
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• Inconsistent review of required monthly reports related to in-bond activity at the ports and 
significant system limitations of the monthly reports, which limit the overall usefulness; 

• CBP does not have the ability to run an oversight report to determine if ports have completed 
all required audits; 

• Formal procedures have not been established that require ports to review the overdue 
immediate transportation in-bonds (M07 report). In addition, the report to track air in-bonds 
(Ml 9) has not been implemented; 

• CBP is unable to determine the status of the in-bond shipments with the information available 
within ACS; 

• National policies or procedures do not exist to monitor the results of in-Bond audits; and 

• CBP does not perform an analysis to determine the potential loss of revenue through the in- 
bond process as a result of goods entering the commerce of the U.S. without formal entry. 

Criteria: 

Under the Code of Federal Regulations (CFR) Title 19, Section 18.2(d), carriers are responsible for 
delivering in-bond manifests to CBP within two days of arrival, and CBP is responsible for assigning 
penalties to any non-arrivals. The CFR states, "Failure to surrender the in-bond manifest or report the 
arrival of bonded merchandise within the prescribed period shall constitute an irregular delivery and the 
initial bonded carrier shall be subject to applicable penalties." 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB 's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

Cause/Effect: 

In recent years, several new directives and new handbooks have been implemented for the In-Bond 
program to address the performance of the program at the port level; however, currently, procedures are 
not in place to address CBP's oversight of the program on a national level. 

The lack of an automatic compilation and analysis of audit results at the national level, results in the 
inability to determine the overall effectiveness of the in-bond audits and weaknesses in the overall In- 
bond program will not be known or identified at the national level. 

The inability to effectively monitor the in-bond process and verify the arrival of in-bond merchandise at 
the port level leads to a potential loss in revenue. This potential loss in revenue is due to uncollected 
duties and fees on in-bond merchandise that has physically entered U.S. commerce without formal entry. 
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Recommendations : 

We recommend that CBP: 

1 . Increase oversight by communicating to the ports the requirements for the in-bond program and 
provide increased training for appropriate personnel to ensure that the requirements are carried 
out accurately; 

2. Ensure all ports perform TinMan audits (physical examinations and post-audits) weekly and 
resolve items on the M02 report (in-bond shipments overdue for export) monthly; 

3. Develop policies and procedures for all ports to: 

a. Maintain documentation evidencing the resolution of items on the in-bond shipments 
overdue for export report (M02); 

b. Maintain documentation evidencing the performance of and results from post audits and 
physical examinations; 

c. Require review of overdue immediate transportation in-bonds (M07 report) and maintain 
documentation evidencing review; and 

d. Require review of the report to track air in-bonds (Ml 9) and maintain documentation 
evidencing review, once the report is implemented. 

4. Update system functionality to provide consistent information between cumulative and weekly 
reports used to track the status of TinMan audits, to compile the results of TinMan audits 
performed during the year, and to evaluate importers' compliance with regulations and overall 
effectiveness of the in-bond program; 

5. Implement standard procedures to periodically analyze the compiled results of all in-bond 
audits performed during the year to ensure the integrity of the data received. Once the results 
are complied, perform an analysis to evaluate importers' compliance with regulations as well as 
the overall effectiveness of the in-bond audits at a national level; and 

6. Analyze the in-bond program annually to determine the potential loss of revenue relating to in- 
bonds. 

2. Compliance Measurement 
Background: 

Compliance Measurement (CM) is the primary method by which CBP measures risk in the areas of cargo 
security, trade compliance, and revenue collection. CBP utilizes the CM program to measure the 
effectiveness of its control mechanisms deployed and its execution in collecting revenues rightfully due 
the U.S. Department of the Treasury. The CM program is a key performance indicator used to determine 
if CBP's internal controls are operating effectively as they pertain to ensuring compliance with laws and 
regulations. The Compliance Measurement program is also used to determine the revenue gap that is 
reported in the "Other Accompanying Information" in the financial statements. 
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Condition: 

We noted the following weaknesses related to CBP's CM Program: 

• CM oversight guidelines do not provide complete coverage over the CM program. CBP 
issued a memorandum to the field explaining the responsibilities of ports in terms of oversight 
required of CM programs at the ports. The memorandum rescinded requirements to use other 
data queries and established CMATS as the single tool for monitoring Compliance 
Measurement at the ports. According to the memo, CMATS was expected to be used on a 
monthly basis to review errors and anomalies at the ports. Through our discussions with CM 
Coordinators at eleven ports as well as our review of the CMATS standard operating 
procedures, we learned that CMATS does not provide timely monitoring of Import Specialist 
Discrepancy Add (ISDA) remarks. In addition, further guidance from the Commercial 
Targeting and Enforcement Directorate of the Office of International Trade (OT) indicated 
that errors and anomalies identified by CMATS did not have to be resolved until January 
2009. Guidance from the Commercial Targeting and Enforcement Directorate also suspended 
the requirement for CM Coordinators at the ports to perform random reviews of non- 
anomalous lines due to an error in the programming of the CMATS tool. The suspension of 
review using the CMATS tool was not replaced by any other data query or tool. 

• Weaknesses in headquarters' (HQ) oversight of the CM program. CBP performs little review 
or analysis over the CM data input remarks at the HQ level to ensure that they are input 
accurately and correctly. Until fiscal year 2006, the National Targeting and Control Branch 
(NTCB), formally known as the National Analysis Specialist Division (NASD), performed 
port audits to identify errors during the performance of a CM review. Since fiscal year 2006, 
CBP-HQ has relied on the Self-Inspection Program (SIP) to determine how the ports are 
performing the CM examinations. We noted in fiscal years 2006, 2007, and again in 2008 
that the SIP worksheets do not provide the equivalent information that was provided by the 
twenty-five point audit report utilized in the NTCB port audits. 

• Untimely results of CM exams. The Compliance Measurement for FY 2008, Appendix B 
mandates that final ISDA remarks and a determination of compliance for CM examinations 
be input within 120 days of the date of entry. Furthermore, ACS cannot provide a detailed 
history of changes made to the ISDA remarks lines. 

We noted that portions of the conditions cited above have been addressed by CBP in response to the CM 
findings from fiscal years 2005, 2006, and 2007 financial statement audits. We noted that based on 
Mission Action Plan (MAP) CBP-MAP-07-17 1.5 that CBP is in the process of developing a query to 
generate a statistically valid random sample of entry summary reviews for the CM coordinator to review 
each month (CBP-MAP-07-17 1.5). In addition to the standardized queries being developed at the port 
level, a series of queries will be run by the CM coordinator at HQ each month, which will randomly select 
CM reviews performed nation wide to ensure that ports are in compliance with CM guidelines and 
requirements. We noted from our inquiry that the elements indicated above, as described in CBP-MAP- 
07-17, were not implemented as of September 2008. As such, these conditions are still applicable for all 
of fiscal year 2008. 
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Criteria: 

Under the Statement of Federal Financial Accounting Standards No. 7, Accounting for Revenue and Other 
Financial Sources, section 69.2, available information on the size of the tax gap states, "Collecting 
entities should provide any relevant estimates of the annual tax gap that become available as a result of 
federal government surveys or studies. The tax gap is defined as taxes or duties due from non-compliant 
taxpayers or importers. Amounts reported should be specifically defined, e.g., whether the tax gap 
includes or excludes estimates of taxes due on illegally earned revenue." 

Under the OMB A-136 Financial Reporting Requirements, Section 12.3, Tax Burden/Tax Gap states, 
"Preparers of statements of entities that collect taxes may consider presenting the information described 
below, if the information is readily available and the preparers believe the information will enhance the 
usefulness of the statements. Refer to SFFAS No. 7 for further guidance." Specifically, we noted the 
following guidance: 

• A perspective on the income tax burden . This could take the form of a summary of the latest available 
information on the income tax and on related income, deductions, exemptions, and credits for 
individuals by income level and for corporations by value of assets. 

• Available information on the size of the tax gap . Collecting entities should provide any relevant 
estimates of the annual tax gap that become available as a result of Federal surveys or studies. 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

Cause/Effect: 

CBP has been challenged to balance its commitment of limited resources to two important mission 
objectives - trade compliance, including the collection of taxes, duties and fees owed to the Federal 
government, and securing the U.S. borders from potential terrorist entry. While these mission objectives 
do overlap somewhat, there are differences in how resources are deployed. 

The weaknesses in the CM program could result in CBP incorrectly evaluating the effectiveness of its 
control environment over the collections of duties, taxes, and fees. In addition, errors within the CM 
program could result in a misstatement of the "revenue gap" disclosure in the Management Discussion 
and Analysis section of CBP's Performance and Accountability Report. 

Recommendations : 

We recommend that CBP implement the following to improve the CM program: 

1 . Provide additional detail in the guidelines, specifying the use of the CMATS tool in addition to 
any other data query or tool to provide complete coverage over the CM program. The guidance 
should also re-address the timing requirements for the monitoring reports or data queries and 
documentation retention; 
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2. Re-formalize and implement effective procedures for the port audit process performed by 
NTCB, or re-address the self-inspection program to provide a more comprehensive and in- 
depth review of port activity (similar to what was accomplished under the previously performed 
port audits), including ensuring that the port is performing the reviews accurately; and 

3. Periodically conduct training to ensure that all port personnel have a comprehensive knowledge 
of the CM program requirements. 

3. Bonded Warehouse and Foreign Trade Zones 

Background: 

Bonded Warehouses (BWH) are facilities under the joint supervision of CBP and the BWH proprietor 
used to store merchandise that has not made entry into U.S. commerce. 

Foreign Trade Zones (FTZ) are secured areas under the joint supervision of CBP and the FTZ operator 
that are considered outside of the U.S. commerce for duty collection. Authority for establishing these 
facilities is granted by the U.S. Department of Commerce's Foreign Trade Zones Board under the 
Foreign Trade Zones Act of 1934, as amended (19 U.S.C. 81a-81u). Foreign and domestic merchandise 
may be admitted into zones for operations not otherwise prohibited by law, including storage, exhibition, 
assembly, manufacturing, and processing. 

Condition: 

We noted the following internal control weaknesses related to the BWH and FTZ processes: 

• CBP does not maintain one centrally managed list of all BWHs and FTZs; 

• Current BWH and FTZ Compliance Review Manuals lack specific guidance for ports to 
determine the appropriate risk assessment of a BWH or FTZ; and 

• Annual compliance review schedules are completed by the ports and provided to 
Headquarters once a year. The HQ retrieval and review of the surveys can take up to 6 
months to compile and analyze. In addition, the monitoring tool used is ineffective as it 
contains no data on the effectiveness of compliance reviews, common discrepancies 
identified in those reviews, risks presented by those discrepancies, or techniques for 
mitigating those risks. 

Criteria: 

Under the Code of Federal Regulations, CBP's supervisory authority over bonded warehouses and 
foreign trade zones is outlined in Title 19, Section 19.4(a), "...the port director may authorize a Customs 
officer to supervise any transaction or procedure at the bonded warehouse facility. Such supervision may 
be performed through periodic audits of the warehouse proprietor's records, quantity counts of goods in 
warehouse inventories, spot checks of selected warehouse transactions or procedures or reviews of 
conditions of recordkeeping, storage, security, or safety in a warehouse facility." Title 19, Section 146.3 
states, (a), "Customs officers will be assigned or detailed to a zone as necessary to maintain appropriate 
Customs supervision of merchandise and records pertaining thereto in the zone, and to protect the 
revenue." (b), "Supervision may be performed through a periodic audit of the operator's records, quantity 
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count of goods in a zone inventory, spot check of selected transactions or procedures, or review of 
recordkeeping, security, or conditions of storage in a zone." 

Under FMFIA, management must implement cost-effective controls to safeguard assets and ensure 
reliable financial reporting. OMB 's Revised Implementation Guidance for FFMIA, states that financial 
systems should "routinely provide reliable financial information consistently, accurately, and reported 
uniformly" to support management of current operations. 

Cause/Effect: 

ACS, CBP's current system, does not maintain a complete listing of BWHs and FTZs. 

Annual training is not provided to BWH/FTZ port personnel for updates, changes, and reinforcement of 
requirements over the program. 

Processes do not exist for the ports to provide on a timely basis the results of the BWH/FTZ compliance 
review schedules and risk assessments to CBP-HQ for review. As a result, CBP-HQ cannot determine 
the effectiveness of the BWH/FTZ program without the ability to track the results on a consistent timely 
basis from the ports. 

It is possible that BWH/FTZ operators and users may be able to operate BWHs and FTZs that contain 
merchandise about which CBP has no knowledge. 

Recommendations : 

We recommend that CBP: 

1 . Develop standardized procedures for HQ or field office oversight to ensure compliance review 
schedules are being reviewed and provide effective timely training to ensure that all ports are 
aware of updates and changes to the program and can consistently execute all requirements 
presented in the compliance review manuals and handbooks; 

2. Continue the current implementation of national databases of all BWHs and FTZs within ACE 
and develop procedures to ensure their completeness. Develop functionality for these databases 
to document the results of risk assessments and compliance reviews; 

3. Develop standard procedures for conducting risk assessments for all BWHs and FTZs. The 
standard procedures should include a questionnaire or checklist, which lists the areas of risk to 
evaluate, the relative importance of each area, and examples of possible high risk indicators; 

4. Implement a standard format for compliance review schedules to be utilized by all ports for 
transmission to CBP-HQ. Ensure timely response and review by HQ personnel; 

5. Develop and implement a more comprehensive electronic port survey system to provide 
additional detailed and timely information on the BWH and FTZ programs; 

6. Using the information received from a more detailed port survey system or through other means, 
prepare an analysis of common discrepancies identified in compliance reviews, risks presented by 
those discrepancies, and techniques for mitigating those risks; 
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7. Increase HQ and field office oversight to ensure that compliance reviews are being conducted 
properly and timely in accordance with the Compliance Review Handbooks; and 

8. Require ports to monitor the bond status of BWHs to ensure each BWH has a valid bond. 
CBP Response: 

See managements' response included in the attached letter. 

D. Information Technology 
Background: 

Controls over information technology (IT) and related financial systems are essential elements of 
financial reporting integrity. Effective general controls in an IT and financial systems environment are 
typically defined in six key control areas: entity-wide security program planning and management, access 
control, application software development and change control, system software, segregation of duties, and 
service continuity. In addition to reliable controls, financial management system functionality is important 
to program monitoring, increasing accountability of financial and program managers, providing better 
information for decision-making, and increasing the efficiency and effectiveness of services provided by 
the Federal government. 

Condition: 

During fiscal year 2008, CBP took corrective actions to address prior year IT control weaknesses. 
However, during fiscal year 2008, we continued to find significant deficiencies related to IT general and 
application controls at CBP. The most significant deficiency from a financial statement audit perspective 
relate to information security. Collectively, the IT control deficiencies limit CBP's ability to ensure that 
critical financial and operational data is maintained in such a manner to ensure confidentiality, integrity, 
and availability. Because of the sensitive nature of the issues identified, we will issue a separate restricted 
distribution report to address those issues in detail. 

Criteria: 

The Federal Information Security Management Act (FISMA), passed as part of the E-Government Act of 
2002, mandates that Federal entities maintain IT security programs in accordance with OMB and National 
Institute of Standards and Technology (NIST) guidance. OMB Circular A-130, Management of Federal 
Information Resources, and various NIST guidelines describe specific essential criteria for maintaining 
effective general IT controls. In addition, OMB Circular A- 127 prescribes policies and standards for 
executive departments and agencies to follow in developing, operating, evaluating, and reporting on 
financial management systems. 

Recommendation: 

Due to the sensitive nature of these findings, our separate report will recommend that CBP management 
implement and enforce certain procedures to address the general and application control vulnerability of 
its financial systems. 
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CBP Response: 

See managements' response included in the attached letter. 
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Compliance with Laws and Regulations 

(Findings A and B - D are presented in Exhibits I and II, respectively) 

E. Federal Information Security Management Act (E-Government Act of 2002) 

CBP is required to comply with the FISMA, which was enacted as part of the E-Government Act of 2002. 
FISMA requires the head of each agency to be responsible for 1) providing information security 
protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, 
use, disclosure, disruption, modification, or destruction of (i) information collected or maintained and (ii) 
information systems used or operated; 2) complying with the requirements of the Act and related policies, 
procedures, standards, and guidelines, including (i) information security standards under the United States 
Code, Title 40, Section 11331 and (ii) information security standards and guidelines for national security 
systems; and 3) ensuring that information security management processes are integrated with agency 
strategic and operational planning processes. We noted instances of non-compliance with FISMA that 
have been reported by us in Exhibit II within Comment D - Information Technology. 

Recommendations: 

We recommend that CBP fully implement the requirements of FISMA in fiscal year 2009. 
CBP Response: 

See managements' response included in the attached letter. 

F. Federal Financial Management Improvement Act of 1996 (FFMIA) 

CBP is required to comply with FFMIA, which requires that an agency's financial management systems 
substantially comply with Federal financial management systems requirements, applicable Federal 
accounting standards, and the United States Government Standard General Ledger at the transaction level. 
We noted instances of non-compliance with FFMIA in relation to Federal financial management systems 
requirements and the United States Government Standard General Ledger at the transaction level. 

Specifically, we noted the following weaknesses: 

1. With respect to Federal financial management system requirements, CBP's inventory 
transactions do not interface between the inventory systems and the financial system (SAP) and 
non-entity accounts receivable do not interface between ACS and SAP; and 

2. With respect to the United States Government Standard General Ledger at the transaction level, 
inventory activity (usage, turn-ins, interagency transfers) and non-entity accounts receivable are 
not recorded at the transaction level in SAP. Non-entity accounts receivable information is 
maintained in ACS, SAP, and on manually prepared schedules. ACS is made up of several 
financial modules that track receivables through entry or case number. Year-end balances are 
posted through the ACS/SAP interface and through manual calculations for receivables not 
recorded through the ACS/SAP interface. 
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Recommendation: 

We recommend that CBP improve its processes to ensure compliance with the FFMIA in fiscal year 
2009. 

CBP Response: 

See managements' response included in the attached letter. 



EXHIBIT IV 

STATUS OF PRIOR YEAR SIGNIFICANT DEFICIENCIES AND NON-COMPLIANCE WITH 

SIGNIFICANT LAWS AND REGULATIONS 



Prior Year Condition 


As Reported at 
September jU, ZUU7 


Status as of September 30, 2008 


Drawback of Duties, Taxes 
and Fees 


Material weakness: ACS lacked controls 
to detect and prevent excessive drawback 
claims and payments, requiring inefficient 
manual processes to compensate and the 
drawback review policies did not require 
drawback specialists to review all related 
drawback claims. 


Continue as a material 
weakness: Weaknesses continue 
to exist related to the drawback 
process in fiscal year 2008. See 
control finding letter A. 


Entry Process - In Bond 


Significant deficiency: Several 
weaknesses existed related to in-bond, such 
as the lack of official guidance and training 
to address the monitoring of in-bond 
shipments at the port level, lack of CBP- 
HQ review of the in-bond program, and the 
overall inability to determine the 
effectiveness of the in-bond program for 
CBP in its entirety. 


Continue as a significant 
deficiency: Although 
improvements were made, 
weaknesses still remain during 
fiscal year 2008. See control 
finding letter C. 


Entry Process - 
Compliance Measurement 
Program 


Significant deficiency: Several 
weaknesses existed related to CMP, such as 
inconsistent procedures followed at the 
ports, reduced CMP sample size, lack of 
NTCB (formally NASD) port audits, and 
little review or analysis on the CM data to 
ensure that it was inputted correctly. 


Continue as a significant 
deficiency: Although 
improvements were made, 
weaknesses still remain during 
fiscal year 2008. See control 
finding letter C. 


Entry Process - Bonded 
Warehouse and Foreign 
Trade Zones 


Significant deficiency: Several 
weaknesses existed related to BWH/FTZ, 
such as the lack of official guidance and 
training to address the monitoring of 
BWH/FTZ, and lack of management 
review of the BWH/FTZ surveys. 


Continue as a significant 
deficiency: Weaknesses continue 
to exist related to the bonded 
warehouse and foreign trade zone 
process during fiscal year 2008. 
See control finding letter C. 


Information Technology 


Material weakness: Weaknesses 
were noted in entity -wide security, 
system access, segregation of duties, 
service continuity, and system software 
change management. 


Reduced to a significant 
deficiency: Improvements were 
made to correct the material 
weakness; however, significant 
deficiencies remain in all areas 
noted during fiscal year 2008. 
See control finding letter D. 


Continued Dumping and 
Subsidy Offset Act of 2000 
(CDSOA) Refunds 


Significant deficiency: Weaknesses 
existed related to CDSOA such as the lack 
of a process to validate and verify CDSOA 
disbursements. 


No longer considered a 
significant deficiency. 


Non-compliance with the 

Federal Information 


Instance of non-compliance: CBP was not 

in substantial compliance with FISMA. 
FISMA requires the head of each agency to 


Continue reporting as an 
instance of non-compliance: 

Although improvements were 
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STATUS OF PRIOR YEAR SIGNIFICANT DEFICIENCIES AND NON-COMPLIANCE WITH 

SIGNIFICANT LAWS AND REGULATIONS 



Prior Year Condition 


As Reported at 
September 30, 2007 


Status as of September 30, 2008 


Security Management Act 


be responsible for 1) providing information 
security protections commensurate with the 
risk and magnitude of the harm resulting 
from unauthorized access, use, disclosure, 
disruption, modification, or destruction of 

(i) information collected or maintained and 

(ii) information systems used or operated; 
2) complying with the requirements of the 
Act and related policies, procedures, 
standards, and guidelines, including (i) 
information security standards under the 
United States Code, Title 40, Section 1 133 1 
and (ii) information security standards and 
guidelines for national security systems; 
and 3) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning 
processes. 


made, CBP did not substantially 
comply with all categories of 
FISMA during fiscal year 2008. 
See compliance finding letter E. 


Non-compliance with the 

Federal Financial 
Management Improvement 
Act of 1996 


Instance of non-compliance: CBP was 

not in substantial compliance with FFMIA, 
which requires that an agency's financial 
management systems substantially comply 
with Federal financial management systems 
requirements, applicable Federal 
accounting standards, and the United States 
Government Standard General Ledger at 
the transaction level. We noted instances of 
non-compliance with FFMIA in relation to 
Federal financial management systems 
requirements, the United States 
Government Standard General Ledger at 
the transaction level, and Federal 
accounting standards 


Continue reporting as an 
instance of non-compliance: 

Although improvements were 
made, CBP did not substantially 
comply with all categories of 
FFMIA during fiscal year 2008. 
See compliance finding letter F. 
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MEMORANDUM FOR: 



Inspector General 

U.S. Department of Homeland Security 



FROM: 



Eugene H. Schied 
Assistant Commissioner 
Office of Finance 



SUBJECT: 



Management Response to Independent Auditor's Report on 
U.S. Customs and Border Protection's Fiscal Year 2008 
Financial Statements 



On behalf of U.S. Customs and Border Protection (CBP), I am responding to the 
Independent Auditor's Report on CBP's Fiscal Year (FY) 2008 Financial Statements, 
which is included in our FY 2008 Performance and Accountability Report. 

I accept the independent public accounting firm's (KPMG) unqualified opinion on 
CBP's FY 2008 Financial Statements, which concluded that CBP's consolidated financial 
statements are fairly presented in all material respects in conformity with accounting 
principles. CBP efforts to resolve identified weaknesses from the FY 2007 audit resulted 
in reducing the "Information Technology" finding from a material weakness to a 
significant deficiency in FY 2008. 

CBP has reviewed and concurs with the one material weakness, three significant 
deficiencies, and two instances of non-compliance with laws and regulations cited in the 
auditor's FY 2008 report. CBP will be preparing Mission Action Plans (MAPs) to 
address these items and will forward such plans to the U.S. Department of Homeland 
Security's Office of Financial Management for review and feedback. CBP will continue 
working to resolve all auditor-identified weaknesses. 

CBP appreciates the opportunity to review this year's audit report and looks forward to 
continuing our strong working relationship with your office. If you have any questions or 
would like additional information, please contact me at (202) 344-2300 or a member of 
your staff may contact Mari Boyd, Executive Director, Financial Operations, at 
(202) 344-2364. 




Eugene H. Schied 
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